Changeset 0.22.5 (#147)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

docs/ROADMAP.md

@@ -105,6 +105,8 @@ v0.22.3 Provider Admin UI + Deferred Polish          ✅
           │
 v0.22.4 Provider Health UX + Project Files + Export   ✅
           │
+v0.22.5 Surfaces + Go Templates + Admin Bug Fixes     ✅
+          │
 v0.23.0 Multi-Participant Channels + Presence
           │
 v0.24.0 Auth Strategy (mTLS/OIDC) + Full RBAC + Group permissions
@@ -1033,6 +1035,51 @@ deferred from earlier releases.
 
 ---
 
+## v0.22.5 — Surfaces + Go Templates + Admin Bug Fixes ✅
+
+Replaces monolithic client-side rendering with server-rendered Go
+templates organized as composable surfaces. Each page route renders a
+dedicated surface that owns its full layout below the classification
+banner. Reusable template components (`model-select`, `team-select`,
+`file-upload`) eliminate duplicated form-building logic and fix data
+population bugs by construction.
+
+**Template Engine:**
+- [x] `html/template` with `//go:embed` for compiled-in templates
+- [x] Custom `FuncMap` (roleFilterType, toJSON, hasPrefix, dict)
+- [x] CSP nonce generation per request
+- [x] Data loaders per surface (pre-fetch exactly what templates need)
+- [x] Base template with banner system (top + bottom, CSS custom properties)
+
+**Surfaces:**
+- [x] Chat surface (`/`, `/chat/:chatID`) — bridge to existing JS
+- [x] Editor surface (`/editor/:wsId`) — server-rendered layout shell, fixes bugs #4 + #5
+- [x] Notes surface (`/notes/:noteId`) — standalone with assist pane
+- [x] Settings surface (`/settings/:section`) — full-page replaces modal
+- [x] Admin surface (`/admin/:section`) — 5 categories, 10+ sections
+- [x] Login page (`/login`) — standalone, cookie-based auth
+
+**Reusable Components:**
+- [x] `model-select` — type-filtered model dropdown (fixes bug #1)
+- [x] `team-select` — pre-populated team picker (fixes bug #2)
+- [x] `file-upload` — drop zone + file picker
+
+**Auth:**
+- [x] `AuthOrRedirect` middleware — cookie JWT, redirect to `/login`
+- [x] `RequireAdminPage()` — role gate for admin pages
+- [x] `sb_token` cookie sync on every token save/refresh
+
+**Editor File Upload (bug #3):**
+- [x] Upload button in toolbar + drag-and-drop on file tree
+- [x] `uploadWorkspaceFile()` API method (binary-safe, respects quota)
+- [x] Auto-open single uploaded text files
+
+**Cleanup:**
+- [x] Removed `/legacy` SPA fallback route
+- [x] nginx.conf: page route proxy blocks before SPA fallback
+
+---
+
 ## v0.23.0 — Multi-Participant Channels + Presence
 
 The channel foundation for workflows and real-time collaboration. Today